Re: [PATCH] ALSA: rawmidi: Drain input work before freeing the runtime

[Takashi Iwai]

On Tue, 13 Oct 2026 09:54:35 +0200,
Cen Zhang wrote:
> 
> The input runtime embeds event_work, so the work must be drained before
> close_substream() frees the runtime. The cancellation in
> snd_rawmidi_input_trigger() runs before close clears substream->opened,
> leaving a window for snd_rawmidi_receive() to enqueue more work.
> 
> With a sequencer subscription to a USB MIDI input port, an in-flight
> completion can overlap the last subscription's midisynth_unsubscribe():
> 
> 1. snd_usbmidi_input_data() observes input_triggered and is delayed
>    before calling snd_rawmidi_receive().
> 2. Unsubscribe enters close_substream(), clears input_triggered through
>    the provider trigger callback and returns from cancel_work_sync().
>    The substream is still opened.
> 3. The completion resumes. snd_rawmidi_receive() takes substream->lock,
>    sees opened set and queues runtime->event_work before dropping the
>    lock.
> 4. Close clears opened under that lock, closes the provider and frees
>    the runtime. Stopping USB URBs does not drain the raw-MIDI work.
> 5. The queued work runs and snd_rawmidi_input_event_work() reads event
>    or substream from the freed runtime, causing a use-after-free.
> 
> Cancel input event_work again after clearing opened, before closing the
> provider or releasing the runtime's private data. Receive holds
> substream->lock through its opened check and work enqueue, so once close
> has cleared opened under that lock, no further receive can queue work.
> The final cancellation therefore drains any late work before the
> runtime is freed. Keep it outside the spinlock so a running callback can
> finish.
> 
> Fixes: b3c705aa9e91 ("ALSA: rawmidi - Use workq for event handling")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>

Applied to for-next branch now.  Thanks.


Takashi